CVE-2026-115929: eMudhra Certs Leak in MongoDB Compass <1.53.1 via Electron
CVE-2026-115929 Published on October 24, 2026
MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
Vulnerability Analysis
CVE-2026-115929 can be exploited with network access. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
Products Associated with CVE-2026-115929
Want to know whenever a new CVE is published for MongoDB Compass? stack.watch will email you.
Affected Versions
MongoDB, Inc. Compass:- Before 1.53.1 is affected.